Methods and Devices for the Concealment of Radio Identifiers and Transmitter Positions

ABSTRACT

Systems, devices and methods for concealing radio communications and the spatial position of radio transmitters involved therein include the use of electrotechnical signal variation and dynamic, pseudo-random radio identifier. Transmitted radio signals contain radio identifiers identifying the transmitting mobile radio device. Each radio identifier is dynamically selected for each radio signal from a sequence of radio identifiers selected from a set of predefined pseudo-random sequences. The sequence is selected based on a predetermined selection rule. The radio identifier is selected from the thus selected sequence according to a predetermined deterministic update pattern associated with the selected sequence. The associated transmission power and/or transmission frequency is dynamically varied on the transmitter side according to a predetermined deterministic variation scheme.

BACKGROUND AND SUMMARY OF THE INVENTION

The present invention relates generally to the concealment of radiocommunication, and of the spatial position of a radio transmitter, e.g.,a mobile transmitter, involved therein, by means of electrical signalvariation and dynamic, pseudorandom radio identifiers. In particular,the invention relates to methods for transmitting radio identifiers andfor identifying, at the receiver, a mobile radio apparatus on the basisof the radio identifiers. The invention also relates to a mobile radioapparatus and a system for carrying out such methods. The invention alsorelates to a vehicle, e.g., a motor vehicle, having such a mobile radioapparatus.

A large number of different technologies and protocols are availabletoday for wireless communication between two or more subscribers. Theseinclude radio technologies for short-range communication over variousdistances, from a few centimeters to a few hundred meters. Thesetechnologies include WLAN (standardized as IEEE 802.11), Bluetooth(standardized by the Bluetooth Special Interest Group and IEEE 802.15.1)and “LTE Direct” mobile radio technology, standardized by 3GPP (Release12 onward). The subscribers involved in wireless communication of thiskind can be mobile terminals, such as for example, mobile phones,smartphones, portable computers (e.g., tablet computers or notebooks),radio interface equipped sensors, and any other devices (e.g., trafficlights, etc.) connected wirelessly in accordance with what is known asthe “Internet of Things,” or “IOT.”

It is customary for the subscribers to use a static subscriber ornetwork address or other radio identifier by means of which they aredetectable and/or addressable by other subscribers, in this context,“static” means that this address or radio identifier does not changeover time and hence is firmly linked to a subscriber device. Examples ofstatic addresses or radio identifiers of this kind are Media AccessControl (MAC) addresses of WLAN-compatible devices, Bluetooth addressesand “LTE Direct expressions.” Such addresses or radio identifiers aretransmitted by the radio apparatuses when radio communication has notyet been established with a remote station, and the radio apparatusmakes itself detectable by other radio apparatuses for the purpose ofsetting up radio communication.

The use of static addresses or radio identifiers of this kind results inthe associated mobile devices being able to be detected and tracked onthe basis of their radio signals that contain addresses or radioidentifiers of this kind. This means that it is also possible forapplicable movement profiles to be created without a user of the devicenoticing or needing to approve such profiling beforehand. For example,it is known that such movement profiles can be used to monitor personsunnoticed or to record and analyze the purchasing behavior of customersin shopping centers or the like. Applications are also constantly beingdeveloped, e.g. within the framework of what are known as location-basedservices, that are based on radio apparatuses (e.g., smartphones) beingable to be identified in a local environment. Such applications, forexample, make it possible to find friends by means of the radioapparatuses they are carrying, to discover offers from outlets close by,or to provide or activate services tailored specifically to a specificsubscriber.

LTE Direct technology also provides for a publicly accessible databaseon what is known as an “Expression Name Server” or “ENS,” in order tolink the radio identifiers of subscribers, referred to as “LTE DirectExpressions,” to associated expression owners (i.e., services, people,companies, organizations, etc.). A distinction is drawn between what areknown as open expressions, on the one hand, for which the assignmentbetween the expression and the expression owner is openly accessible,and restricted, or private, expressions, on the other hand. In the caseof the latter, a requesting subscriber is notified of the assignment ofexpressions to the associated persons, etc., by the ENS only ifappropriate authorization has been provided beforehand. To assign theradio identifiers to the respective expression owner, it is possible touse what is known as a cryptographic hash function, as is known fromcryptology.

Against this background, individual approaches for protectingsubscribers from unauthorized location and movement tracking by thirdparties are known from the prior art. “LEI, M. et al.; ProtectingLocation Privacy with Dynamic MAC Address Exchanging in WirelessNetworks; Intelligence and Security Informatics; 2007 IEEE” describes amethod that involves the MAC addresses of active subscribers in a localarea network (LAN) being regularly interchanged among one another bymeans of unidirectional cyclic substitution, so that a firm assignmentof MAC addresses to specific subscribers is cancelled. The mobileoperating system iOS (iOS 8 version onward) from Apple, Inc. also uses,at least in certain situations, randomly generated MAC addresses insteadof a unique MAC address for the applicable iOS device in the case ofWLANs in order to protect against tracking.

Furthermore, authentication systems for access control for networks areknown that involve cryptographic hash functions being used to regularly(e.g., every 30 seconds) generate a new password that is required forsuccessful access in the applicable period up until the password ischanged again. Such a system is the “SecurID” system from the RSASecurity company, for example.

The German laid-open specification DE 102015204210 A1 describes aproposed solution for detecting mobile radio apparatuses by means ofdynamic, pseudorandom radio identifiers. In particular, it describesmethods for generating and transmitting such radio identifiers and foridentifying a mobile radio apparatus on the basis of such radioidentifiers.

This involves a pseudorandom sequence of radio identifiers beinggenerated using a generation rule and on the basis of an initializationwith a predetermined initialization value referenced to a specific time.Radio signals that each contain one of the radio identifiers of thesequence as an identity linked to the transmitting radio apparatus canbe transmitted and can be received by a remote station that likewise hasthe secret authorization information required for generating thesequence. The respective current radio identifier is selected from thesequence of radio identifiers using a predetermined deterministic updatescheme.

The present invention is based on the object of providing an even moreimproved solution for protecting mobile radio apparatuses from detectionand/or tracking thereof by unauthorized third parties.

A first aspect of the invention relates to a method for transmittingradio identifiers by means of a mobile radio apparatus. The methodinvolves: repeatedly transmitting radio signals that each carry a radioidentifier as an identity, linked to the radio apparatus, with respectto a receiver of the radio signals. This respective radio identifier isselected for each of the radio signals dynamically from a sequence ofradio identifiers that is contained in a set M, wherein M contains anumber of N∈

predefined sequences, which are each pseudorandom and, if N>1, are eachdifferent than one another, of radio identifiers.

The respective radio identifier is selected in that: if N=1, from theone sequence contained in M, a predetermined deterministic update schemeassigned to this sequence is used to select one of the radio identifierscontained in said sequence; and if N>1, one of the sequences is selectedusing a predetermined selection rule and, from the thus selectedsequence, a predetermined deterministic update scheme assigned to thissequence is used to select one of the radio identifiers contained insaid sequence.

The repeated transmission of the radio signals involves, at least forone of the radio signals, the associated transmission power and/or theassociated transmission frequency being dynamically varied at thetransmitter, using a predetermined deterministic variation scheme, incomparison with the transmission power and transmission frequency of animmediately preceding instance of the radio signals.

A “radio identifier” or “identifier” for short within the context of theinvention should be understood to mean information (in particular acharacteristic feature, character or a totality of characteristicfeatures or characters) transmitted by means of a radio signal foruniquely identifying something, in particular the radio apparatustransmitting the radio signal. In particular, data or signals impressedon a radio signal, such as for example characteristic bit sequences ormodulation signals, by means of which a source or a transmitter of theradio signal can be identified are a “radio identifier” within thecontext of the invention.

A “mobile radio apparatus,” and variants thereof, within the context ofthe invention, should be understood to mean an apparatus by means ofwhich radio signals that have at least one radio identifier can betransmitted and that is mobile. “Mobile” within the context of theinvention should be understood to mean that the radio apparatus isdesigned to change its physical position, in particular to be physicallymoved within this context by a user (i) directly or (ii) indirectly bycoupling or as part of a larger unit. In particular, portable terminalssuch as mobile phones, smartphones, smart watches, portable computers,including tablet computers, and radio apparatuses in or on vehicles,which are movable at least together with the vehicle or as part thereof,are mobile radio apparatuses within the context of the invention.

A “pseudorandom sequence” or “sequence” or “chain” of radio identifiers,and variants thereof, within the context of the invention should beunderstood to mean an ordered sequence of radio identifiers that can begenerated deterministically and hence reproducibly using a generationrule, proceeding from an initial value as input value for the generationrule, and the sequence of individual radio identifiers of which ispseudorandom within the context of the standard mathematical meaning,that is to say that, although calculable, it cannot be distinguished, orcan be distinguished only with very great difficulty, from real, i.e.nondeterministic, randomness from the perspective of the viewer.

A “value” or “input value” or “initial value” or “output value,” andvariants thereof, within the context of the invention should beunderstood to mean privately presentable information suitable for use asan input or output variable for the generation rule. As such, inparticular bit sequences or alphanumeric characters (numbers, letters orspecial characters) and character strings comprising these can be“values” within the context of the invention.

A “deterministic update scheme,” and variants thereof, within thecontext of the invention should be understood to mean a rule accordingto which it is explicitly determinable, for different times, which radioidentifier from the sequence of radio identifiers is current, i.e. needsto be selected, at the time. In particular, a rule according to whichthe respective next radio identifier of the sequence is current at fixedidentical intervals of time (periods), or according to which saididentifier is current at different but predetermined intervals of time,is a deterministic update scheme within the context of the invention.The same applies in general to a rule, in particular a mathematicalfunction, that allocates a respective specific radio identifier todifferent times on a time scale.

A “transmission frequency” of a radio signal, and variants thereof,within the context of the invention should be understood to mean afrequency or a frequency range, in particular a frequency band, that isused for transmitting the radio signal. In the simplest case, it can bea specific carrier frequency of the radio signal or an individual radiochannel, defined by means of a frequency range, within a largerfrequency range.

“Dynamic varying of the transmission frequency using a deterministicvariation scheme,” and variants thereof, within the context of theinvention should be understood to mean that the respective transmissionfrequencies for successive radio signals are altered (in some aspects,repeatedly) in a deterministic manner defined by the variation scheme,so that the repeated transmission of the radio signals involves at leasttwo (usually more) instances of the transmitted radio signals having amutually different transmission frequency determined using the variationscheme. This varying of the transmission frequency is distinguishedfrom, for example, a frequency change during modulation of the radiosignal for the purpose of enriching information or impressinginformation, by means of frequency modulation (FM) or phase modulationor a combination of these. In the simple case of a carrier frequency,varying the transmission frequency corresponds to an alteration of thecarrier frequency, while frequency modulation is known to produce afrequency fluctuation, determined by the information to be modulated,onto the carrier frequency, about the carrier frequency, which as suchremains constant. A change of radio channel accompanying a change offrequency band is also varying of the transmission frequency within thecontext of the invention.

The method according to the invention for transmitting radio identifiersis used to transmit radio identifiers that are not trackable orpredictable, or are trackable or predictable only with extremedifficulty, by an unauthorized third party, whereas the sequence ofradio identifiers is readily able to be reconstructed by authorizedthird parties and can be used to detect the transmitting radio apparatuson the basis of its radio identifiers. In contrast to the solutiondescribed in DE 102015204210 A1, in which only a single sequence ratherthan deliberate variation of the transmission powers or transmissionfrequencies of the radio signals is described, a deliberate varyingtakes place in the case of the present invention. In this manner, it ismade even more difficult for an unauthorized receiver to detect anassignment of the radio signals to a specific transmitter (or, forexample, a specific vehicle having such a transmitter) for which aspecific constant transmission frequency or a transmission frequencyshifted by Doppler effect on approach or departure as appropriate and aradio signal strength at a receiver corresponding to the distancebetween a transmitter and the receiver would typically be expected, ofcourse.

During a radio transmission, it is inevitably also possible for otherreceivers that are in the reception range of a radio signal to receivethe radio signals. From the signal strength of such a radio signal,measured at the receiver, it is possible to estimate the distancebetween the transmitter and the receiver. It is also possible toestimate the relative speed between the transmitter and the receiverfrom the frequency of the radio signal, as measured at the receiver end,if the transmission frequency is known, by means of the Doppler effect.A change of signal strength or a signal frequency divergence is usuallyinterpreted as a change of distance. A transmission power that is nowconsciously altered according to the invention, and hence a receiver-endsignal strength or a transmission frequency deliberately altered at thetransmitter end, therefore imitates an altered transmitter distance andspeed to undesirable eavesdroppers. This makes it difficult to discovera position of the transmitter. Undesirable eavesdroppers can be confusedin this manner and the particular position of the transmitter can beconcealed. Assignment of a signal to the transmitter is thereforehampered. This applies even if the transmitter is part of a vehicle(e.g., a motor vehicle), which means that the position and theassociation of the signal with a specific vehicle is concealed in thismanner. Such a transmitter can be provided in order to conveymeasurement data captured by sensor (for example from a tire pressuresensor) wirelessly within the vehicle, for example to a control unit.

Moreover, the present invention can optionally also involve the use ofmultiple (N>1) different pseudorandom sequences, so that a next radioidentifier to be used for transmitting a signal is selected not justfrom a single sequence but rather from a set of different sequences. Inthis manner, the security level with regard to unauthorizedidentification or tracking of the transmitter can be increased evenfurther, since attacks based on a correlation analysis e.g., acorrelation analysis of the change of radio identifiers over time) areadditionally hampered. The use of a plurality of different radioidentifier chains (i.e., radio identifier sequences) therefore meansthat the assignment of a detected signal correlation to a specificindividual transmitter is hampered for an authorized eavesdropper orattacker, at least provided that at least two different transmitterstransmit in the same period. Authorized receivers, on the other hand,are able to take their knowledge of the associated generation rules andinitializations for the respective individual pseudorandom sequences andof the selection rule for selecting a sequence to be used from the setof sequences as a basis for tracing, as a basis for the transmitter-endradio identifier selection based thereon, and as a basis forsynchronizing themselves to the transmitter end in this regard. In thismanner, detection of the transmitting radio apparatus or of the radiosignals thereof even over a change of radio identifier is made possibleat the receiver end.

The invention is applicable for a wide variety of radio transmissions,including for analog and digital, and also for packet orsignal-stream-based transmission methods.

Other objects, advantages, aspects and features of the present inventionwill be apparent to one skilled in the relevant art in view of thefollowing detailed description of one or more exemplary embodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

The features, objects, and advantages of the present invention willbecome more apparent from the detailed description, set forth below,when taken in conjunction with the drawings, in which like referencecharacters identify correspondingly throughout and wherein:

FIG. 1 schematically shows a vehicle and mobile radio apparatusaccording to at least one aspect of the invention;

FIG. 2 shows a graph illustrating methods according to at least oneaspect of the invention, with regard to variation of transmission power;

FIG. 3 shows a graph illustrating methods according to at least oneaspect of the invention, with regard to variation of transmissionfrequency;

FIG. 4 shows a graph illustrating methods according to at least oneaspect of the invention, with regard to a case in which only onesequence is used (i.e., N=1 case);

FIG. 5 shows a graph illustrating methods according to at least oneaspect of the invention, with regard to a case in which a plurality ofdifferent sequences is used (i.e., N>1);

FIGS. 6A-6C show an exemplary embodiment of the transmitter-end methodaccording to the first aspect of the invention; and

FIG. 7 shows an exemplary embodiment of a receiver-end method accordingto at least one aspect of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The above described drawing figures illustrate the present invention inat least one embodiment, which is further defined in detail in thefollowing description. Those having ordinary skill in the art may beable to make alterations and modifications to what is described hereinwithout departing from its spirit and scope. While the present inventionis susceptible of embodiment in many different forms, there is shown inthe drawings and will herein be described in detail at least onepreferred embodiment of the invention with the understanding that thepresent disclosure is to be considered as an exemplification of theprinciples of the present invention, and is not intended to limit thebroad aspects of the present invention to any embodiment illustrated. Itwill therefore be understood that what is illustrated is set forth forthe purposes of example, and should not be taken as a limitation on thescope of the present invention. It will be understood that while atleast one embodiment is described below, the various embodiments oraspects thereof are combinable with one another unless expressly ruledout or technically impossible.

In some embodiments, the method involves generating or retaining the Npseudorandom sequences of radio identifiers of the set M by means of themobile radio apparatus, wherein each of the sequences is based on arespective generation rule assigned to said sequence and aninitialization of the sequence with an initialization value assignedthereto that is referenced to a specific time. In this manner, themobile radio apparatus itself is rendered able to generate or retrievethe required radio identifiers without this requiring, during itsoperative mode, an external data source for providing this information.

In some embodiments, the variation scheme is used to vary thetransmission power, in particular as a whole or in sequence-basedfashion, for successive radio signals by combining, in particularadditively overlaying, a first variation with a second variation,wherein the first variation is defined by means of a trend function,defined for the sequence of radio signals, that in turn stipulates asystematic variation of the transmission power for this sequence. Thissystematic variation is defined over a sequence of at least threesuccessive radio signals and has a monotonously rising or fallingcharacteristic. The second variation is carried out for each radiosignal affected by the varying and is pseudorandomly controlled in adeterministic manner. In this manner, a steadily departing orapproaching transmitter can be simulated at least over a specific periodor a specific subsequence of the radio signals.

In some embodiments, to this end, the variation scheme is used todetermine the transmission power for a next radio signal, affected bythe varying, starting from a transmission power stipulated for apreceding radio signal affected by the varying, by adding a functionvalue, obtained for this next radio signal, of the trend functionaccording to the first variation and a pseudorandomly generated randomnumber according to the second variation. Optionally, in an embodimentthat is particularly simple to implement, the trend function can inparticular also be a. constant function (which, in the case ofperiodically transmitted radio signals, corresponds to a linear rise orfall in the transmission power and hence, at the receiver end, based onthe received signal strength, apparently corresponds to a constantrelative speed between the transmitter and the receiver) and thereforedefined by means of a constant trend value as function value. As such,the transmission power P_(s)(i+1) of said next radio signal can easilybe represented by the transmission power P_(s)(i) of said precedingradio signal as follows:

P _(s)(i+1)=P _(s)(i)+T(i+1)+Z(i+1)

where the index i numbers the respective successive radio signals whosetransmission powers are varied using the variation scheme, T(i)indicates the trend function, which may be T(i+1):=T=constant (with thetrend value T), and Z(i+1) is a pseudorandom number whose absolute valuepreferably adheres to |Z(i+1)|<|T(i+1)|, so that the trend functiondominates over the random component and hence the concealment effectthereof is not canceled again by the random component used for furtherhampering assignment to a transmitter.

In particular, according to the variation scheme for the trend function,the average period of time between two immediately successive turningpoints at which the function changes from a monotonously risingcharacteristic to a monotonously falling characteristic or vice versa ispreferably longer than the average corresponding period of time for thesecond variation.

In some embodiments, if N>1 then the varying of the transmission powerand the transmission frequency for successive radio signals using thevariation scheme is defined in sequence-based fashion, so that, for atleast one specific instance, preferably for all, of the sequences, avarying of the transmission power and the transmission frequency that isindependent of the corresponding varying for any other sequence iseffected for those successive radio signals that carry a radioidentifier from this specific sequence. In this manner, the complexityof the totality of the radio signals received by an unauthorizedeavesdropper and hence also the concealment effect can be increasedfurther still. In particular, correlation-based attacks are thushampered further.

In some embodiments based thereon, according to the variation scheme thevarying of the transmission power and the transmission frequency for thesuccessive radio signals that carry a radio identifier of the respectiveat least one specific sequence is at least sometimes pseudorandomlycontrolled in a deterministic manner. On the one hand, this allowsimplementation of a variation that is not traceable by the unauthorizedeavesdropper but that is, on the other hand, traceable by the authorizedreceiver on the basis of its deterministic generation rule, so that thereceiver can gear itself to accordingly variable received signalstrengths and/or transmission frequencies for the purpose of error-freereception of the radio signals.

In some embodiments, both a trend function and the sequence-basedvarying of the transmission power and the transmission frequency forsuccessive radio signals are used. Preferably, according to thevariation scheme, the respective varying of the transmission power of atleast two of the N>1 sequences is carried out by means of an individualtrend function assigned to the respective sequence, wherein at least twoof the trend functions have no correlation between them. As such, thedesired concealment can be reinforced further and in particular thedifficulty for correlation-based attacks can be increased further.

In some embodiments, the number N of sequences in the set M from whichthat sequence from which the next radio identifier to be used fortransmitting one of the radio signals is to be selected is selectedusing the selection rule is dynamically varied. This can, according todifferent variants, be achieved in particular by means of one or more ofthe following measures: (i) generating one or more new sequences; (ii)deleting one or more already existent sequences; (iii) at leasttemporarily activating or deactivating one or more already existentsequences, so that only currently activated sequences are selectableusing the selection rule, while currently deactivated sequences areselectable again only after fresh activation. In this manner, thedifficulty for identifying and tracking a specific transmitter and hencethe security of the method can be increased even further, since a fixednumber of different sequences is now not used. Instead, the number ofsequences available at a given time for selecting a radio identifier isa further variable and hence, from the point of view of the attacker, anincreased complexity.

In some embodiments, at least one of the measures for dynamicallyvarying the number of sequences is pseudorandomly controlled in adeterministic manner. Hence, this instance involves not only (i) thegeneration of the respective sequences in pseudorandomly controlledfashion in each case, but (ii) also the stipulation of the number ofcurrently available sequences and (iii)—at any rate in some variants(see above)—also the selection of a specific sequence from the set ofcurrently available sequences according to the selection rule.Therefore, deterministic and therefore also particularly efficientreconstruction of the selection of the radio identifier made at thetransmitter is possible at the receiver for each of the radio signals inall of said cases (i) to (iii).

In some further embodiments, when a new sequence is generated or analready existent sequence is activated, deactivated or deleted,applicable logon and logoff information for the sequence is sent to thereceiver of the radio signals in a manner protected against unauthorizedaccess. In this manner, the receiver or receivers can be notified ofwhich sequences are currently available or being used, in order for thetransmitter to send a next radio signal having an applicable radioidentifier selected from these sequences. This logon and logoffinformation can be sent to the receiver or receivers in particular bymeans of encrypted communication.

In some further embodiments, (i) a new sequence is generated such thatthe transmission power and/or the transmission frequency of the radiosignals transmitted with a radio identifier from this new sequenceinitially rises monotonously, in particular from a minimum value definedfor the transmission power, for a sequence of at least three immediatelysuccessive instances of these radio signals and/or (ii) an alreadyexistent sequence is deleted such that prior to that the transmissionpower and/or the transmission frequency of the radio signals carrying aradio identifier from this already existent sequence initially fallsmonotonously for a sequence of at least three immediately successiveinstances of these radio signals, in particular from a minimum valuedefined for the transmission power. In this manner, the unauthorizedeavesdropper can be given the impression that, in the first case (i), aremote transmitter (or a remote vehicle) is coming into range, or, inthe second case (ii), a remote transmitter (or a remote vehicle) hasgone out of range. In this manner, the concealment effect is thereforereinforced, since actually the transmitter may even still be positionedat the same distance from the eavesdropper within the range or evenmoving away from or towards said eavesdropper.

In some embodiments, if N>1, the predetermined selection rule is used toselect that sequence from which the next radio identifier to be used fortransmitting one of the radio signals is to be selected in one of thefollowing ways: (a) deterministically, in particular using adeterministic random number generator; (b) non-deterministically, inparticular using a nondeterministic random number generator. Variant (a)with deterministic, in particular pseudorandom, selection of a sequencehas the advantage that the relevant sequence can be selected at thereceiver directly on the basis of knowledge of the selection rule.Variant (b), by contrast, provides an even higher level of securityagainst tracking on the basis of the nondeterministic selection, but atthe cost of increased sophistication at the receiver, since the sequencecorresponding to the received radio identifier cannot be determineddeterministically there. Instead, it first needs to be found on thebasis of usually multiple comparisons of the received radio identifierwith the applicable radio identifiers respectively determined from theavailable sequences.

In some embodiments, the selection of that sequence from which the nextradio identifier to be used for transmitting one of the radio signals isto be selected is made using the selection rule on the basis of the typeof the information to be conveyed to the receiver by means of the radiosignal. In one possible variant in this regard, the selection of thatsequence from which a selection is to he made for a radio identifier fora next radio signal for conveying a specific type of information is madeusing the selection rule on the basis of the type of information in sucha manner that (i) respective different assigned subsets of the set ofsequences that is formed from the plurality of sequences are defined fordifferent types of information, and (ii) the selection of the radioidentifier for the information to be conveyed with the radio signal ismade only from those sequences that are contained in the subset ofsequences that is assigned to the type of information to be conveyedwith the radio signal. By way of example—and without this being intendedto be interpreted as a limitation—a set consisting of four activesequences Seq1 to Seq4 divided into a first subset containing thesequences Seq1 and Seq2 and a second subset containing the sequencesSeq3 and Seq4 could be available for conveying different types of sensordata to a central control unit in a vehicle by radio. The sequences Seq1and Seq2 in the first subset could be used just for conveying tirepressure data captured by pressure sensors on the tires, while thesequences Seq3 and Seq4 in the second subset could be used just forconveying exterior temperature data captured by means of a temperaturesensor. These embodiments firstly make it easier for the respectivereceiver to find the correct assignment for specific data, because saidreceiver can limit itself to sequences from the respective subsetassigned to the data when finding the relevant radio identifier. On theother hand, they simultaneously also increase the diversity of thesequences among one another and therefore further hamper a successfulcorrelation analysis for the diversely appearing sequences in regard tothe same transmitter. As such, for example a good many sequences usuallyappear to be much more active than others, which means that they cannotreadily be assigned to one another as associated with the sametransmitter on the basis of a comparable, in particular uniform,activity.

In some embodiments, at least one radio signal from the transmittedsequence of radio signals, which radio signal is selected in apredetermined manner, in particular pseudorandomly selected in adeterministic manner, additionally carries information indicating theoccurrence of a transmission error independently of an actual occurrenceof a transmission error in a preceding instance of the radio signals.This information can be or contain in particular a request for freshtransmission of the last radio signal. In this manner, additionalconfusion for an unauthorized eavesdropper in regard to a real receiversituation can be produced by virtue of reception difficulties beingsimulated.

A second aspect of the invention relates to a method for identifying afirst mobile radio apparatus on a receiving apparatus, in particular asecond mobile radio apparatus. The method comprises the following steps:(i) receiving a radio signal that carries a radio identifier as anidentity linked to a signal source transmitting the radio signal,wherein a dynamic configuration of the receiving apparatus for areceived signal strength and/or a reception frequency for receiving theradio signal is performed using a deterministic variation scheme thatcorresponds to that of the transmitter end for the radio signal and issynchronized thereto; (ii) comparing the radio identifier of thereceived radio signal either (a) with a radio identifier m apredetermined sequence of radio identifiers, wherein the radioidentifier is selected from the radio identifiers defined by thesequence, using a predetermined deterministic update scheme assigned tothis sequence; or (h) with one or more radio identifiers that are eachselected from another sequence, which are selected from a plurality ofpredefined, different and respectively pseudorandom sequences of radioidentifiers using a predetermined selection rule, using a predetermineddeterministic update scheme assigned to the respective selectedsequence; and (iii) triggering a predetermined functionality on thereceiving apparatus only if the comparison reveals that the receivedradio identifier is concordant with one of the radio identifierscompared therewith according to a predetermined comparison criterion.

The method according to the invention for identifying a first(transmitting) mobile radio apparatus on a receiving apparatus can beused on the latter to check whether a received radio signal isassociated with a first mobile radio apparatus or is an identity thereoffor which the receiving apparatus has authorization to trace the radioidentifier sequences thereof. If this is the case, the first radioapparatus can also be tracked by the authorized receiving apparatus bymeans of the radio identifiers of said first radio apparatus, despitesaid radio identifiers changing over time, and a communicationconnection can therefore be started or continued. This is not possiblefor unauthorized receiving apparatuses, on the other hand, owing to alack of traceability of the series of radio identifiers used. Duringauthorization, the receiver apparatus is notified of all information(authorization information) that is required in order to render thereceiver apparatus capable of using, in particular itself generating,the same sequences of radio identifiers as the first radio apparatus.Furthermore, the receiving apparatus is similarly also rendered capableof itself determining the respective signal strengths and/or receptionfrequencies to be expected for the series from radio signals transmittedby the first radio apparatus that are to be received, and accordinglyconfiguring itself to receive these radio signals, in particular bysetting an appropriate signal gain and/or tuning to the receptionfrequencies in the received signal path of the receiving apparatus.

The authorization information regularly contains for each of thesequences at least the generation rule, an associated initializationvalue referenced to a specific time and the update scheme. Moreover,authorization information contains the selection rule for selecting thesequences to be used for a specific radio signal. The update scheme andthe coupling of the initialization value to a specific time can be usedby the transmitting first radio apparatus and the receiver apparatus togenerate identical and temporally coordinated sequences of radioidentifiers for each of the sequences on the basis of the samegeneration rule or to select from a plurality of retained or accessiblesequences, so that the current radio identifiers from thetransmitter-end sequence are identical to the corresponding receiver-endsequences at a given time.

The methods according to the first and second aspects of the invention,in particular when interacting, can in particular also be used toachieve the following advantages: first, increased data protection canbe attained, since trackability by means of radio identifiercomparisons, in particular network address comparisons, in the case ofstatic radio identifiers is no longer possible, whereas this continuesto be possible for authorized receiver apparatuses. There is also norequirement for external mediators or databases, such as for example theENS in the case of the conventional LTE Direct approach, which preventsfirstly higher technical complexity and higher costs, but secondly alsothe possibility of misuse. In particular, such tracking by the operatorof an ENS is prevented or at least hampered. In addition, the requireddata traffic is reduced in comparison with centralized solutions by thedisappearance of a central location (e.g. ENS), since no further queriesfrom subscribers are required at the central location because therequired authorization information is retained locally instead. Even ifa central database is also used, for example in order to makeinformation associated with the individual subscribers or radioapparatuses available to third parties, if this database ever fails thendetection and tracking of mobile radio apparatuses acting astransmitters remains available as part of the authorizations therefor,since this is no longer dependent on the central database or location.

In some of these embodiments, (i) the one or more sequences to beselected using the selection rule are selected at the receiver on thebasis of the type of information contained in the received radio signalin such a manner that different assigned subsets of the set of sequencesthat is formed from the plurality of sequences are respectively selectedfor different types of information; and (ii) the radio identifiers areselected for comparison with the radio identifier of the received radiosignal only from those one or more sequences that are contained in thesubset of sequences that is selected in this manner and assigned to thetype of information from the received radio signal. In this way, thereceiver end can restrict itself to a smaller number of sequences andhence radio identifiers therefrom that can be used for the comparisonwith the radio identifier of the received signal even in the case of anondeterministic selection rule when receiving a radio signal andidentifying its transmitter end (mobile radio apparatus). This canincrease efficiency at the receiver end and, moreover, in interactionwith the corresponding transmitter end, allows higher diversity amongthe sequences to be achieved. As such, in particular undesirable attacksbased on correlation analyses of the diversely appearing sequences arehampered further. The sequences used for radio transmission of the radiosignals from the same transmitter end can thus have significantlydifferent frequencies of use among one another and can appear to beassociated with different transmitters, for example, since they cannotbe assigned to one another on the basis of a uniform activity, forexample.

In some embodiments, the predetermined functionality is dependent on therespective radio identifier detected by the comparison. In this way, atleast one assigned functionality can be triggered specifically for eachdetected radio identifier, so that there can be provision at thereceiver for a distinction in regard to the reaction to differenttransmitting radio apparatuses. In particular, in the case of a receiverapparatus in a vehicle, it is thus possible for differentfunctionalities to be triggered for a received radio signal from aspecific first vehicle sensor than when receiving a radio signal. from asecond sensor or even a vehicle-external radio apparatus, for example asmartphone of the vehicle owner. The first sensor could thus be atemperature sensor, for example, and the associated functionality to betriggered could be updating a temperature indicator in the vehicle. Thesecond sensor could be a fill level sensor (e.g. for screen wash) andthe functionality to be triggered could be checking the sensor signalagainst a minimum value and, if the minimum value is not reached,triggering a warning signal. When the smartphone of the user isdetected, a welcome presentation could be triggered if the vehicle issimultaneously locked or the engine is switched off.

In some embodiments, each of the pseudorandom sequences of radioidentifiers is generated reproducibly using a generation rule,proceeding from an initial value as input value for the generation rule.The generation rule comprises the iterative use of a cryptographic hashfunction that, on every iteration, provides an output value for therespective iteration from at least one input value, said output valuebeing used to derive the radio identifier for the associated element ofthe sequence of radio identifiers. The initialization value is used asan input value for the first iteration, and the respective output valueof the immediately preceding iteration is used as an input value for thesubsequent iterations. In this way, it is possible to use a mathematicalfunction to iteratively generate a pseudorandom sequence of identifiersin a compact manner. This sequence can at least sometimes be generatedin advance already, so that when the radio identifier is updated only arespective next radio identifier, already generated beforehand, from thesequence is selected as current radio identifier. Alternatively, therespective next radio identifier can instead be generated again by meansof the hash function during the next update each time, so that there isadvantageously no requirement for a memory for retaining radioidentifiers already generated in advance. Hybrid forms of these are alsopossible.

The term “cryptographic hash function,” and variants thereof, isconsistent with the meaning thereof as used in cryptology. What isinvolved is thus a hash function that, in the mathematical sense, iscollision-resistant or a one-way function (or both). A hash function isa function that maps a character string of arbitrary length onto acharacter string of fixed length. A one-way function in this instance isa function H for which it is practically impossible to find for a givenoutput value y an input value x that the hash function maps ontoy(H(x)=y). A hash function is (weakly) collision-resistant if it ispractically impossible to find for a given value x a different value x′that results in the same hash value H(x)=H(x′)=y for x≠x′. Whencollision resistance is strong, both input values x and x′ can moreoverbe chosen freely. Known more recent variants of cryptological hashfunctions are known by the names FORK-256, SHA-3 and BLAKE. In addition,there are also many further cryptological hash functions with differentsecurity levels.

In some embodiments, the associated radio identifier for at least one ofthe iterations is generated by applying an information-reducingderivation rule to the output value of this iteration. In this manner,it is firstly possible to use output values for the cryptographic hashfunction that contain more information or have a different format thanthe radio identifier. The format of the radio identifier may be inparticular standardized in some applications. Secondly, it also allowsan additional security benefit to he achieved because recovering theoutput values of the hash function from the radio identifiers receivedby an unauthorized third party and prediction of future sequenceelements on the basis thereof is additionally prevented, at any ratehampered.

In some embodiments, the information-reducing derivation rule of atleast one of the sequences defines a selection of a subset of symbolsfrom a symbol-based, in particular numeric or alphanumeric,representation of the output value. In this manner, a simpleimplementation of the information-reducing derivation rule is possiblewithout great sophistication, since no further calculations are requiredtherefor. In particular, primitive masking or filtering of specificplaces in the representation of the output value of the hash function issufficient.

In some embodiments, the update scheme of at least one of the sequencesdefines regular replacement of the current radio identifier therespective next radio identifier from the sequence of radio identifiersafter a predetermined period of time has elapsed in each case. Thepredetermined period of time can be chosen either to be the same for allupdates or, instead, to be different for different updates.

In some embodiments, the radio identifiers are network addresses orradio channels in a local radio network or are derived therefrom Inparticular, in some embodiments, the radio identifiers to be comparedcan each be network addresses or radio channels in at least one of thefollowing: (i) a WLAN network, (ii) a Bluetooth® network, and (iii) amobile radio network, in particular an LTE network, preferably of awireless onboard network in a vehicle.

A third aspect of the invention relates to a mobile radio apparatus.This has (i) a communication device for radio communication with aremote station and (ii) a processing device for generating pseudorandomsequences of radio identifiers and for selecting radio identifiers fromthe sequences. The mobile radio apparatus is configured to carry out themethod according to the first and/or the second aspect of the invention.

The term “configured,” and variants thereof, within the context of theinvention should be understood to mean that the applicable apparatus isset up (or able to be set up in the case of “configurable”) to perform aspecific function. The configuration can take place for example by meansof appropriate setting of parameters of a process sequence or ofswitches or the like for activating and deactivating functionalities andsettings—or bay any other appropriate setting of hardware and/orsoftware. In particular, the apparatus can have multiple predeterminedconfigurations or modes of operation, so that the configuration can beperformed by selecting one of these configurations or modes ofoperation.

In some embodiments, the radio apparatus is coupled to or integrated ina functional component of a vehicle such that during operation the radioapparatus uses the method according to the first aspect to transmitradio identifiers, or uses the method according to the second aspect toreceive and evaluate radio identifiers, by means of which, in the caseof transmission, the functional component itself is identifiable or, inthe case of reception, another radio apparatus is identifiable to thefunctional component. In some embodiments, the functional component is acontrol unit, a sensor, in particular a tire pressure sensor, anactuator, or gateway to an onboard network of the vehicle.

A fourth aspect of the invention relates to a system for transmittingand identifying radio identifiers. The system has (i) at least one firstmobile radio apparatus according to the third aspect of the invention,which is configured or configurable to carry out the method according tothe first aspect of the invention, in particular according to one ormore of the associated embodiments described herein. Moreover, thesystem (ii) has at least one receiving apparatus, in particular at leastone second mobile radio apparatus, which is configured or configurableto interact with the at least one first mobile radio apparatus acting asa transmitter to carry out the method according to the second aspect ofthe invention, in particular according to one or more of the associatedembodiments described herein.

In some embodiments of the system, the second mobile radio apparatus isalso set up to transmit radio signals, in particular to the first radioapparatus, using the method according to the first aspect, specificallysuch that the varying of the transmission power and/or transmissionfrequency of radio signals transmitted by the first radio apparatus iseffected in the same way as and in synchronization with the varying ofthe transmission power and/or transmission frequency of radio signalstransmitted by the second radio apparatus. These embodiments areadvantageously usable in particular when both radio apparatuses aremoved in combination with one another, for example when they are bothinstalled in the same vehicle, because synchronous transmission-powerand transmission-frequency variations, as expected, are then generatedfor an unauthorized eavesdropper. The two radio apparatuses cansynchronize themselves explicitly, for example, such as for example bymeans of a message or a portion thereof (or else implicitly, for exampleby means of measurements of the signal strengths and transmissionfrequencies of the respective other radio apparatus).

A fifth aspect of the invention relates to a vehicle, in particular amotor vehicle, having a mobile radio apparatus according to the thirdaspect of the invention or a system according to the fourth aspect ofthe invention.

The features and advantages illustrated with reference to the firstaspect (at the transmitter) or the second aspect (at the receiver)accordingly also apply to the other aspects of the inventionaccordingly.

Turning now to FIG. 1, a vehicle, more precisely a motor vehicle 1, thathas multiple functional components, is shown. A first of thesefunctional components is a tire sensor 2 designed to measure the tirepressure and the speed of the wheel and to convey each of these measuredvalues to a control unit 5 via a radio connection. A further functionalcomponent of the vehicle is a locking system 4, which acts as anactuator and can be actuated by the control unit 5 in order to open orlock the vehicle. A gateway (protocol converter) 6 is provided as afurther functional component, which is an interface between, on the onehand, an air interface to a mobile radio apparatus 3, in particular asmartphone, which uses LTE technology, in particular uses LTE Direct inconjunction with LTE-D2D (LTE Device-to-Device), or WLAN to communicatewith the gateway 6, and, on the other hand, an onboard network of thevehicle 1, to which the control unit 5 is also connected wirelessly orby wire or optically. The connection can be made in particular via aknown bus system, such as for example a standardized CAN or MOST busthat is known for motor vehicles, or Ethernet.

All of these functional components each have an incorporated radiocommunication apparatus or are themselves such an apparatus, and in eachcase, this is—again as part of the vehicle—a mobile radio communicationapparatus within the context of the invention. Each of these radiocommunication apparatuses has a processing unit and a communicationunit. This is depicted in FIG. 1 by way of example for the functionalcomponent control unit 5, which has a processing unit 5 a and acommunication unit 5 b. The arrows in FIG. 1 are typical communicationdirections between the functional components and the vehicle-externalsmartphone 3.

A first application for the invention in this situation could be that anapproach of the smartphone 3 of the vehicle owner is detected by settingup a radio connection to the gateway 6 by using a radio identifierselection from multiple radio identifier sequences (N>1 case) of thesmartphone 3 that are known to the gateway 6 but otherwise secret. Thegateway 6 reports this via the onboard. network on to the control unit5, which in turn uses a radio connection to use a radio identifierselection from a plurality of other radio identifier sequences that areknown to the processing unit of the locking system 4 but otherwisesecret to activate the locking system 4 by means of an appropriate radiosignal, in order to unlock the vehicle.

In another application, a radio connection is made between the tiresensor 2, which, as part of the moving wheel of the vehicle, executes arotational movement relative thereto while traveling, and the controlunit 5, wherein the tire sensor 2 acts as a transmitter for conveyingmeasurement results concerning the tire pressure and transmits its radiosignals to the control unit 5, acting as receiver, with radioidentifiers according to a radio identifier selection from a radioidentifier sequence (N=1 case) or else a plurality of secret radioidentifier sequences (N>1 case) individual to said sensor, which is orare known to the control unit 5, however, or is or are able to bereconstructed there on the basis of the associated authorizationinformation. In the same way, the likewise measured rotation speed canalso be conveyed, either with the same radio signal or else with anindividual dedicated radio signal on the basis of a radio identifierselection from other sequences of radio identifiers. The authorizationinformation for the tire sensor 2 may in particular already have beenstored in the control unit 5 during an initialization at the factory.When the measurement results are conveyed, the transmitter dynamicallyvaries the associated transmission power and/or the associatedtransmission frequency for at least one of the radio signals incomparison with the transmission power and/or transmission frequency ofan immediately preceding instance of the radio signals using apredetermined deterministic variation scheme, in particular as describedin more detail below with reference to FIGS. 2, 3 and 6A-C.

FIG. 2 is a schematic timing chart to fundamentally illustrate themethods according to the invention with regard to a transmitter-endvariation of the transmission power. It shows an exemplary timecharacteristic for a variation, used at the transmitter for transmittingsuccessive radio signals m₁ to m₁₃ at the times t₁ to t₁₃, of theapplicable transmission power. The individual radio signals m₁ to m₁₃can each contain a radio identifier comprising (i) a sequence S1 that isthe same for all radio signals (N=1 case, cf. FIG. 4) or else (ii)different sequences S1 to SN (>1 case, cf. FIG. 5).

At the same time, FIG. 2, in a different interpretation for the N>1case, depicts a preferred embodiment in which, in this instance, onlythe characteristic of the transmission power with reference to radiosignals from only one specific sequence from the set M of the sequencesS1 to SN is depicted. The sequence is generated at the time t₀ and,after the radio signals m₁ to m₁₃ have been transmitted, deleted againat the time t₁₄ (cf. more accurate illustration in this regard in thedescription relating to FIG. 5). In this interpretation, m₁ to m₁₃denote only those radio signals that contain a radio identifier from thespecific sequence, while radio signals having radio identifiers fromother sequences can be transmitted between the radio signals m₁ to m₁₃during the same period defined by t₀ and t₁₄, so that by and large amixture of radio identifiers used from different sequences is obtainedover the period (cf. FIG. 5). The varying of the transmission power andthe transmission frequency for successive radio signals using thevariation scheme is therefore defined in sequence-based fashion in thisinstance, so that, for at least one specific sequence, preferably forall of the sequences, a varying of the transmission power and thetransmission frequency that is independent of the corresponding varyingfor any other sequence is effected for those successive radio signalsthat carry a radio identifier from this specific sequence. In this way,the complexity of the totality of the radio signals received by anunauthorized eavesdropper and hence also the concealment effect can beincreased further still. In particular, correlation-based attacks arethus hampered further.

The variation scheme used to vary the transmission power in adeterministic manner in the example from FIG. 2 is defined such that thetransmission power for a respective next radio signal is variedproceeding from a transmission power stipulated for a preceding radiosignal by means of two mutually independent variations. The first ofthese variations consists in adding a function value, obtained for thisnext radio signal m_(i), of a trend function T(i)—which in this instanceis chosen in exemplary fashion as a periodically constant functionT(i)=constant. In this case it is defined as positive asT(i)=T1=constant, where T1>0 for i=1, . . . , 10, for the time period upto t₁₀ and negative as T(i)=T2=constant, where T2<0 for i=11, . . . ,13, for the subsequent time period from t₁₁ to t₁₄. The second of thevariations is effected by adding a pseudorandomly generated randomnumber Z(i). The choice of the trend function as a periodically constantfunction can be implemented particularly easily and used in particularto imitate an apparently constant relative speed between the transmitterand the receiver.

The transmission power P_(s)(i+1) of the respective next radio signalm_(i+1) can therefore easily be represented by the transmission powerP_(s)(i) of said preceding radio signal as follows:

P _(s)(i+1)=P _(s)(i)+T(i+1)+Z(i+1)

where the index i numbers the respective successive radio signals whosetransmission powers are varied using the variation scheme and T(i)indicates the trend function, which—as depicted in FIG. 2—may inparticular also be periodically constant. Z(i+1) is the pseudorandomnumber according to the second variation, whose absolute valuepreferably adheres to |Z(i+1)|<|T(i+1)|, so that the trend functiondominates over the random component and hence the concealment effectthereof is not canceled again by the random component used for furtherhampering assignment to a transmitter. In particular, according to thevariation scheme for the trend function, the average period of timebetween two immediately successive turning points at which the functionchanges from a monotonously rising characteristic to a monotonouslyfalling characteristic or vice versa is preferably longer than theaverage corresponding period of time for the second variation. This caseis likewise depicted in FIG. 2, where the fluctuations in thetransmission power about the rising and falling branches of thetransmission power curve, which are contingent upon the value T1 and thevalue T2, respectively, change from radio signal to radio signal andtherefore have a much higher frequency than the change in the functionvalues of the trend function T(i). In other exemplary variants (notdepicted), the trend function T(i) may be stipulated in particularsinusoidally or as a polynomially defined curve, in particular also onlyperiodically. As such, the trend function may be defined as a sinewavehalf-cycle, for example.

FIG. 3 similarly illustrates an exemplary embodiment with regard to avariation of the transmission frequency. Instead of or in addition tothe transmission power, a variation of the transmission frequency isperformed in this instance proceeding from a predetermined transmissionfrequency F₀, which in particular can correspond to a central frequencyof a specific prescribed frequency range [Fmin; Fmax] to be used fortransmitting the radio signals, which frequency range in particular cancorrespond to a specific radio channel according to a transmissiontechnology used. The variation of the transmission frequency can bedefined in particular periodically such that in the respective periodthe transmission frequency used for the radio signals transmittedtherein is always higher than F₀ or always lower than F₀, which can beused to simulate an approach or departure by the transmitter to or fromthe receiver on the basis of the known Doppler effect. In the exampleshown in FIG. 3, the radio signals m₁ and m₁₁ are transmitted at F₀,whereas the successive radio signals m₂ to m₁₀ are transmitted at atransmission frequency above that, while the signals m₁₂ and m₁₃ aretransmitted at a transmission frequency below F₀. As already explainedin relation to FIG. 2, the graph, depending on interpretation, canrelate (i) to the case in which it describes transmission frequencyindependently of sequences used for selecting the applicable radioidentifier of the signals, or else (ii) to the case in which itdescribes the variation of the transmission frequency of only onespecific instance of the sequences N in the N>1 case in sequence-basedfashion.

FIG. 4 depicts a graph to fundamentally illustrate the methods accordingto the invention based on the first and second aspects of the inventionon the basis of an exemplary embodiment with regard to the case in whichonly one sequence S1 is used (N=1 case). Consequently, the radioidentifiers of the various successive radio signals—which are shown inthis instance in exemplary fashion as radio signals m₁ to m₈—are takenfrom this one, i.e. the same, sequence S1, wherein they are eachgenerated using the update scheme associated with the sequence, and aretherefore different than one another. The advantage of this embodimentlies in a particularly simple solution that is implementable withparticularly low resource involvement. Accordingly, the transmissionpower and/or transmission frequency shown in FIG. 2 and FIG. 3 arevaried with reference to this one sequence S1 in this instance.

FIG. 5 is a schematic timing chart to fundamentally illustrate themethods according to the invention based on the first and secondaspects. It shows N=4 exemplary radio identifier sequences S1 to S4, andthe assignment of various radio signals m₁ to m₁₀ to be transmitted, forexample in the form of messages for communicating measurement resultscaptured by sensor, to these sequences. At the beginning, at the timet₀, only the first sequence S1 is active, while the other sequences S2to S4 are either not initialized at all or else deactivated. A firstradio signal m₁ to be transmitted can therefore only resort to thesequence S1, and is accordingly provided with a first radio identifierfrom this sequence S1. At the respective subsequent times t₂ and t₃, thesecond sequence S2 and the third sequence S3, respectively, areinitialized or else, if this has already occurred beforehand, activated.A further radio signal, in particular also from the same transmitter,can then be transmitted on the basis of a selection rule, which selectsamong the available sequences the one that is to be used, also—asdepicted—by means of a radio identifier from the sequence S2 (or S3)(time t₄). The sequence S1 continues to remain active, so that a furtherradio signal can be provided with the next radio identifier updatedusing the associated update scheme of the sequence S1 again (time t₅) onthe basis of the selection rule. For the next radio signal that is to betransmitted at the time t₆, there fundamentally continue to be thesequences S1 to S3 available, from which one sequence is selected usingthe selection rule. In the example depicted, this is again the sequenceS2, so that the radio signal m₄ is provided with a radio identifier fromthe sequence S2.

At the subsequent time t₇, the sequence S4 is also initialized oractivated, so that all four sequences S1 to S4 are now fundamentallyavailable for radio signals that are to be transmitted, subject to theselection rule. As such, for example the radio signal m₅ to betransmitted at the subsequent time t₈ can be assigned to the sequence S3using the selection rule and can obtain its radio identifier from saidsequence. At the time t₉, the sequence S3 is deactivated or evendeleted, on the other hand, so that it is subsequently at leasttemporarily (in the case of mere deactivation) no longer available.Therefore, fundamentally only the sequences S1, S2 and S4 are availablefor transmitting the subsequent radio signals m₆, m₇ and m₈ (times t₁₀,t₁₁, t₁₂). In the example depicted, the respectively usable selectionrule respectively selects a radio identifier from the first sequence S1for m₆ and m₇ and a radio identifier from the sequence S2 for m₈. At thesubsequent time t₁₃, the first sequence S1 is deleted or deactivated, sothat it is no longer available for transmitting the further radiosignals m₉ and m₁₀ depicted in FIG. 2. Instead, only the sequences S2and S4 are now available for these radio signals. The respectiveselection rule is used to assign the radio signal m9, which is to betransmitted at the time t₁₄, to the sequence S4, which radio signalcontains its radio identifier from said sequence, whereas this is thesequence S2 for the further radio signal m₁₀ that is to be transmittedat the time t₁₅.

In the simplest case, all of the radio signals m₁ to m₁₀ are associatedwith the same transmitter/receiver pair. In other, more complex, cases,however, multiple transmitter/receiver pairs are involved that providetheir radio signals with radio identifiers from a plurality of thesequences S1 to S4. In particular, it is also possible for a subset ofthe total available sequences to be defined at least for one, preferablyfor each, transmitter/receiver pair, so that only sequences from thissubset are used to provide applicable radio identifiers for thistransmitter/receiver pair.

At the receiver, the sequences S1 to S4 are used in equal measure togenerate the radio identifiers that are to be compared against thereceived radio signals for the purpose of identifying the respectivetransmitter.

Accordingly, in the embodiments depicted in FIG 5, the varying of thetransmission power and/or transmission frequency shown in FIG. 2 or FIG.3 can be referenced in particular to each of the sequences in the setM={S1, . . . , S4} individually, or else by and large over all sequencesor else only over a subset of the set M of sequences.

Referring to the flowchart depicted in FIGS. 6A-6C, an exemplaryembodiment of the transmitter-end method according to the first aspectof the invention is described in more detail below. The left-hand halfof each of the figures shows the method sequence generically, while thesame method is illustrated in parallel on the right-hand side of each ofthe figures on the basis of concrete examples.

The method first has an initialization phase comprising steps 101 to 108depicted in the flowchart. In step 101, a maximum number Nmax (whereNmax is a natural number, i.e. Nmax ∈

) of simultaneously available sequences is defined, as Nmax:=6 in theexample shown. In addition, a counter n is initialized, as n:=0 in theexample. The number N of sequences to be initialized during theinitialization phase can then be set equal to Nmax in particular, or, asin the example shown, stipulated on a. pseudorandom-controlled basis bytaking into consideration the maximum number of sequences defined byNmax and a minimum number of two sequences. The function RAND(Nmax)supposed to represent a pseudorandom function of this kind in thisinstance, which outputs a value between 1 and Nmax. Naturally, otherways of stipulating the number N of sequences are also conceivable.

In the subsequent step 102, the counter n is incremented and in step 103a check is performed to determine whether still further sequences needto be initialized. If this is not the case (103—yes), the processbranches directly to step 107 described later on. Otherwise (103—no), aninitial value x[n; 0] is generated in step 104 for the current sequencecorresponding to the counter reading of n as a secret number for thissequence, the initial value being generated either on anondeterministically random basis or else, as depicted in this instance,pseudorandomly. The freely selectable parameter xmax in this instancerepresents a boundary for the range of values in which the initial valueis pseudorandomly generated. This can be accomplished in particular byusing a known method for nondeterministically generating random numberson the basis of physical effects, such as for example pulse variationsin electronic circuits (e.g. thermal noise in a resistor) or the like.In step 105, which in particular can also coincide with step 104,further authorization information is stipulated for the sequence. Thisis in particular the generation rule for a sequence of radio identifiersy[n; i], where i=1, 2, . . . , which specifies a hash function f_(n) anda derivation function g_(n) applicable to the output values thereof, andalso an update scheme and the initial time t_(n)[0] thereof that servesas a time reference. In the present example, the update scheme consistsin the respective next radio identifier in the sequence being chosen ascurrent radio identifier periodically at constant intervals of time,e.g. dt_(n)=10 s.

Additionally, the authorization information can optionally—as shown inFIG. 6A—contain variation information that allows the receiver end totrace a transmitter-end varying of the transmission power (and henceaccordingly of the correlative signal strength measured at the receiver)and/or of the transmission frequency of the successively transmittedradio signals, and to dynamically configure the receiver as appropriatewith regard thereto. This variation information therefore defines adeterministic variation scheme, according to which the transmissionpower and/or the transmission frequency (or correlative variables) canbe determined for a next radio signal that is to be transmitted. Thevariation scheme for the transmission power and/or the transmissionfrequency may in particular each be defined by means of an associatedtrend function T_(n) and an associated random function Z_(n) along withassociated initial value Z[n; 0], as described above. Alternatively (notshown), however, it is possible for the variation information not to betransmitted if the receiver is capable of correctly processing thereceived signal strength and reception frequency varying in accordancewith the transmitter-end varying of the transmission power andtransmission frequency without this requiring appropriate configurationfor the varying. This normally presupposes that the transmitter-endvarying of the transmission power and the transmission frequency remainsrestricted to specific power and frequency ranges that are within theframework of the applicable radio specification of the receiver.

In step 106, this authorization information is transmitted to thereceiver via a secure communication channel and also stored at thetransmitter. The process then returns to step 102.

If the initialization loop is left in step 103 (103—yes), a selectionrule for sequence selection is also stipulated in subsequent step 107.This can involve, as in the present example, determining subsets, inparticular assigned to specific types of information, of the total setof active sequences. In the example, for example a first subset A hasbeen defined that has the sequences 2 and 3 and is intended specificallyfor tire pressure information from a specific vehicle wheel. A furthersubset B, which has the sequences 4 and 5, is assigned for informationrelating to the wheel speed of the same vehicle wheel, on the otherhand. Moreover, a pseudorandom function h is defined that is used toselect one specific sequence within a subset, when there are multipleactive sequences present therein, as a source of a radio identifier forthe next radio signal that is to be transmitted. In step 108, theselection rule is likewise sent to the receiver via the securecommunication channel. In particular in connection with radiocommunication between functional components within a vehicle 1, steps101 to 108 and the associated steps of receiving the informationtransmitted in the process at the receiver end can already take place inthe factory as part of an initialization procedure.

The operative phase that follows the initialization phase begins with astep 109, in which, in the present example, in order to vary the numberof sequences active in each case, said sequences are activated ordeactivated on a selectively (deterministically or nondeterministically)random-controlled basis. So that there is always the assurance that anyradio signals to be transmitted can always obtain a current radioidentifier from an active sequence assigned to the type of informationconveyed with said radio signals, the activation or deactivation takesplace on the proviso that, for each subset A, B, at least one of thesequences contained therein must always be active. The currentstipulation of which the sequences are currently activated ordeactivated is likewise conveyed to the receiver (e.g. as logon orlogoff information for the sequences), which can be accomplished on thebasis of an activity vector S_(N), for example, as depicted on theright-hand side of FIG. 3B for the step 109, which, for each sequence,contains a value, e.g. a bit, indicating whether the associated sequenceis currently active or inactive.

The method is therefore then ready to transmit a new radio signal.Whether such a signal is available is checked in step 110. If this isthe case (110—yes), a sequence j is pseudorandomly selected (by means ofthe function h) in step 111 from a subset A or B of the active sequencesthat is determined by the type of information to be transmitted with theradio signal. Otherwise (110—no), the check in step 110 is repeateduntil a new radio signal to be transmitted is available or terminationof the method is requested (not depicted).

A check is also performed in step 112 for the selected sequence j inorder to determine whether the assigned period of time dt_(j) haselapsed and therefore a fresh update is pending. The period of time maybe implemented by means of a counter, for example, which counts up to athreshold value that corresponds to the period of time (correspondingbackward counting in the sense of a countdown is naturally alsoconceivable), then triggers an output signalling that the period of timehas elapsed, and immediately afterwards begins the next counting. Inaddition to or independently of such circulating counting, it is alsopossible for the applicable check to be performed just on the basis ofknowledge of the initial value t_(j)[0] and the period of time dt_(j).If the current period of time dt_(j) has not yet elapsed on the basis ofthe check in step 112, which means that there is not yet a need forupdate (112—no), the method skips directly to step 116, in which theradio signal with the current radio identifier y[j; i] from the sequencej is transmitted to the assigned receiver. Otherwise (112—yes), the nextiteration i:=i+1 is triggered for the sequence j using its updatescheme.

For update purposes, the hash function f_(j) specified in the updateinformation is applied to the last secret number x[j; i−1] in step 114in order to obtain a new output value, i.e. a new secret number x[j;i]=f(x; i−1). This new secret number is used firstly as input value forthe next iteration, and secondly as input value for the derivationfunction g_(j), which derives the radio identifier y[j; i] for thecurrently running iteration from the secret number x[j; i] in step 115.In the example, the derivation is obtained by virtue of digits 4 to 6 inthe secret number being filtered out and forming the respective newradio identifier y[j; i]. For the first iteration, in the example shownin FIG. 3C, this is the radio identifier:

Y[j; 1]=g _(j)(f(x[j; 0]))=g _(j)(f _(j)(25360256))=g_(j)(82219463295)=419.

Since only a portion of the generated secret number x[j; i] is thereforetransferred to the radio identifier y[j; i], the derivation functiong_(j) has an information-reducing effect, since the secret number x[j;i] cannot be reconstructed definitely from the radio identifier y[j; i]derived therefrom, which means that additional security againstunauthorized tracking is provided in this instance.

In a further step 116, a transmission power P(j; i) for the currentiteration i is calculated, which is effected in sequence-based fashionand, in particular, as depicted in the right-hand example pertaining tostep 116 in FIG. 6C, by means of the applicable function values of thetrend function T_(j)(i) and the random function Z_(j)(i) for the currentiteration and on the basis of the transmission power P(j; i−1) of thepreceding iteration.

In step 117, the radio signal, optionally also multiple radio signals,is finally transmitted with the current radio identifier y[j; i] and thetransmission power P(j; i) determined in step 116 to the associatedreceiver. The method then branches back to step 109 for a fresh pass.

FIG. 7 illustrates an embodiment of the applicable receiver lateralmethod according to the second aspect of the invention in interactionwith the transmitter-end method already described above.

In a step 201, the authorization information transmitted by thetransmitter in step 106 is received. In a further step 202, theinformation pertaining to the selection rule and pertaining to thestipulation of active and inactive sequences that is conveyed by thetransmitter in steps 108 and 109 is also received. Steps 201 and 202 cannaturally also coincide—on the basis of the times at which theapplicable transmission steps 106, 108, 109 respectively take place.

At the receiver, the respective update schemes are applied continuallyin step 203, so as always to obtain a current radio identifier y[n; i]for each of the defined N sequences by using the associated hashfunctions and derivation functions in the same way as described at thetransmitter in steps 113 to 115. For each sequence n, the receiver caninfer from the update scheme and knowledge of the initial time t_(n)[0]which iteration is current at the transmitter right now, i.e. whichradio identifier of the sequence the transmitter might use to transmitat present.

In a further step 204, an expected received signal strength iscalculated from the authorization information Z[n; 0], T_(n),Z_(n)received in step 201 beforehand and the receiver is configured asappropriate in order to ensure optimum reception of the next radiosignal.

In a step 205 a radio signal that was transmitted by the transmitter instep 117 is then received and in a step 206 the radio identifier isextracted from the radio signal and compared with the current radioidentifier or the current radio identifiers of the active sequence, orpossibly plurality of active sequences, possible according to theinformation received in steps 201 and 202 using a predefined comparisoncriterion. The comparison criterion can in particular involve checkingwhether the two compared radio identifiers are concordant. If thecomparison criterion is satisfied, an appropriate assigned functionalityis triggered at the receiver in step 207, as already described inexemplary fashion above in connection with FIG. 1.

Even if not explicitly depicted in FIGS. 6 to 6C and 7, the method inrespect of optional varying of the transmission frequency can take placein accordance with the varying of the transmission power, but inparticular the transmission frequency can be provided independently ofthe variation of the transmission power.

The objects, advantages and features described in detail above areconsidered novel over the prior art of record and are consideredcritical to the operation of at least one embodiment of the presentinvention and to the achievement of at least one objective of thepresent invention. The words used in this specification to describethese objects, advantages and features are to be understood not only inthe sense of their commonly defined meanings, but also to include anyspecial definition with regard to structure, material or acts that wouldbe understood by one of ordinary skilled in the art to apply in thecontext of the entire disclosure.

Moreover, various elements described herein generally include hardwareand/or software/firmware, including but not limited to: processors,memories, input/output interfaces, operating systems and networkinterfaces, configured to effectuate the functionalities describedherein. When implemented in software, the elements of the invention areessentially the code segments to perform the necessary tasks. The codesegments can be stored in a processor readable medium or transmitted bya computer data signal. The “processor readable medium” may include anymedium that can store information. Examples of the processor readablemedium include an electronic circuit, a semiconductor memory device, aROM, a flash memory or other non-volatile memory, a floppy diskette, aCD-ROM, an optical disk, a hard disk, etc.

As used herein, the terms “a” or “an” shall mean one or more than one.The term “plurality” shall mean two or more than two. The term “another”is defined as a second or more. The terms “including” and/or “having”are open ended (e.g., comprising). The term “or” as used herein is to beinterpreted as inclusive or meaning any one or any combination.Therefore, “A, B or C” means “any of the following: A; B; C; A and B; Aand C; B and C; A, B and C. An exception to this definition will occuronly when a combination of elements, functions, steps or acts are insome way inherently mutually exclusive.

Reference throughout this document to “one embodiment”, “certainembodiments”, “an embodiment” or similar term means that a particularfeature, structure, or characteristic described in connection with theembodiment is included in at least one embodiment of the presentinvention. Thus, the appearances of such phrases or in various placesthroughout this specification are not necessarily all referring to thesame embodiment. Furthermore, the particular features, structures, orcharacteristics may be combined in any suitable manner on one or moreembodiments without limitation. Thus, while at least one embodiment hasbeen described above, it should be noted that a large number ofvariations therefor exist. It should also be borne in mind that theexemplary embodiments described are only nonlimiting examples, and it isnot the intention to thereby restrict the scope, the applicability orthe configuration of the apparatuses and methods described herein.Rather, the above description will provide a person skilled in the artwith instructions for implementing at least one exemplary embodiment, itbeing understood that various changes in the function and thearrangement of the elements described in one exemplary embodiment may bemade without thereby deviating from the subject matter respectivelydefined in the appended claims and its legal equivalents.

Moreover, the definitions of the words or drawing elements describedherein are meant to include not only the combination of elements whichare literally set forth, but all equivalent structures, materials oracts for performing substantially the same function in substantially thesame way to obtain substantially the same result. In this sense, it istherefore contemplated that an equivalent substitution of two or moreelements may be made for any one of the elements described and itsvarious embodiments or that a single element may be substituted for twoor more elements in a claim without departing from the scope of thepresent invention.

Changes from the claimed subject matter as viewed by a person withordinary skill in the art, now known or later devised, are expresslycontemplated as being equivalents within the scope intended and itsvarious embodiments. Therefore, obvious substitutions now or later knownto one with ordinary skill in the art are defined to be within the scopeof the defined elements. This disclosure is thus meant to be understoodto include what is specifically illustrated and described above, what isconceptually equivalent, what can be obviously substituted, and alsowhat incorporates the essential ideas.

The scope of this description is to be interpreted in conjunction withthe appended claims.

LIST OF REFERENCE SIGNS

-   1 vehicle (motor vehicle)-   2 tire sensor-   3 mobile radio apparatus (for example smartphone)-   4 locking system-   5 control unit-   5 a processing unit-   5 b communication unit-   6 gateway-   S1, . . . , SN radio identifier sequences (sequences)

1-15. (canceled)
 16. A method for transmitting radio identifiers bymeans of a mobile radio apparatus, the method comprising: repeatedlytransmitting radio signals that each carry a radio identifier as anidentity, linked to the radio apparatus, with respect to a receiver ofthe radio signals, wherein this respective radio identifier is selectedfor each of the radio signals dynamically from a sequence of radioidentifiers that is contained in a set, wherein the set contains anumber of N∈

predefined sequences, which are each pseudorandom and, if N>1, are eachdifferent than one another, of radio identifiers, and the respectiveradio identifier is selected in that: if N=1, from the one sequencecontained in M, a predetermined deterministic update scheme assigned tothis sequence is used to select one of the radio identifiers containedin said sequence; and if N>1, one of the sequences is selected using apredetermined selection rule and, from the thus selected sequence, apredetermined deterministic update scheme assigned to this sequence isused to select one of the radio identifiers contained in said sequence;and the repeated transmission of the radio signals involves, at leastfor one of the radio signals, the associated transmission power and/orthe associated transmission frequency being dynamically varied at thetransmitter, using a predetermined deterministic variation scheme, incomparison with the transmission power and transmission frequency of animmediately preceding instance of the radio signals.
 17. The method ofclaim 16, wherein the variation scheme is used to vary the transmissionpower for successive radio signals by combining a first variation with asecond variation, wherein the first variation is defined by means of atrend function, defined for the sequence of radio signals, that in turnstipulates a systematic variation of the transmission power for thissequence, wherein this systematic variation is defined over a sequenceof at least three successive radio signals and has a monotonously risingor falling characteristic, and the second variation is effected for eachradio signal affected by the varying and is pseudorandomly controlled ina deterministic manner.
 18. The method of claim 17, wherein thevariation scheme is used to determine the transmission power for a nextradio signal affected by the varying, starting from a transmission powerstipulated for a preceding radio signal affected by the varying, byadding a function value, obtained for this next radio signal, of thetrend function according to the first variation and a pseudorandomlygenerated random number according to the second variation.
 19. Themethod of claim 16, wherein if N>1 then the varying of the transmissionpower and the transmission frequency for successive radio signals usingthe variation scheme is defined in sequence-based fashion, so that, forat least one specific instance of the sequences, a varying of thetransmission power and the transmission frequency that is independent ofthe corresponding varying for any other sequence is effected for thosesuccessive radio signals that carry a radio identifier from thisspecific sequence.
 20. The method of claim 19, wherein according to thevariation scheme the varying of the transmission power and thetransmission frequency for the successive radio signals that carry aradio identifier of the respective at least one specific sequence is atleast sometimes pseudorandomly controlled in a deterministic manner. 21.The method according to 20, wherein according to the variation schemethe respective varying of the transmission power of at least two of theN>1 sequences is effected by means of an individual trend functionassigned to the respective sequence, wherein at least two of the trendfunctions have no correlation between them.
 22. The method of claim 16,wherein the variation scheme is used to vary the transmission power forsuccessive radio signals by combining a first variation with a secondvariation, wherein the first variation is defined by means of a trendfunction, defined for the sequence of radio signals, that in turnstipulates a systematic variation of the transmission power for thissequence, wherein this systematic variation is defined over a sequenceof at least three successive radio signals and has a monotonously risingor falling characteristic, and the second variation is effected for eachradio signal affected by the varying and is pseudorandomly controlled ina deterministic manner, wherein if N>1 then the varying of thetransmission power and the transmission frequency for successive radiosignals using the variation scheme is defined in sequence-based fashion,so that, for at least one specific instance of the sequences, a varyingof the transmission power and the transmission frequency that isindependent of the corresponding varying for any other sequence iseffected for those successive radio signals that carry a radioidentifier from this specific sequence, and wherein according to thevariation scheme the respective varying of the transmission power of atleast two of the N>1 sequences is effected by means of an individualtrend function assigned to the respective sequence, wherein at least twoof the trend functions have no correlation between them.
 3. The methodof claim 16, wherein the variation scheme is used to determine thetransmission power for a next radio signal affected by the varying,starting from a transmission power stipulated for a preceding radiosignal affected by the varying, by adding a function value, obtained forthis next radio signal, of the trend function according to the firstvariation and a pseudorandomly generated random number according to thesecond variation, wherein if N>1 then the varying of the transmissionpower and the transmission frequency for successive radio signals usingthe variation scheme is defined in sequence-based fashion, so that, forat least one specific instance of the sequences, a varying of thetransmission power and the transmission frequency that is independent ofthe corresponding varying for any other sequence is effected for thosesuccessive radio signals that carry a radio identifier from thisspecific sequence, and wherein according to the variation scheme therespective varying of the transmission power of at least two of the N>1sequences is effected by means of an individual trend function assignedto the respective sequence, wherein at least two of the trend functionshave no correlation between them.
 24. The method of claim 16, whereinthe number N of sequences in the set from which that sequence from whichthe next radio identifier to be used for transmitting one of the radiosignals is to be selected is selected using the selection rule isdynamically varied.
 25. The method of claim 24, wherein the number N ofsequences is dynamically varied by means of one or more of the followingmeasures: generating one or more new sequences; deleting one or morealready existent sequences; at least temporarily activating ordeactivating one or more already existent sequences, so that onlycurrently activated sequences are selectable using the selection rule,while currently deactivated sequences are selectable again only afterfresh activation.
 26. The method of claim 25, wherein: a new sequence isgenerated such that the transmission power and/or the transmissionfrequency of the radio signals transmitted with a radio identifier fromthis new sequence initially rises monotonously for a sequence of atleast three immediately successive instances of these radio signals;and/or an already existent sequence is deleted such that prior to thatthe transmission power and/or the transmission frequency of the radiosignals carrying with a radio identifier from this already existentsequence initially falls monotonously for a sequence of at least threeimmediately successive instances of these radio signals.
 27. The methodof claim 16, wherein at least one radio signal selected in apredetermined manner from the transmitted sequence of radio signalsadditionally carries information indicating the occurrence of atransmission error independently of an actual occurrence of atransmission error in a preceding instance of the radio signals.
 28. Amethod for identifying a mobile radio apparatus on a receivingapparatus, wherein the method comprises the following steps: receiving aradio signal that carries a radio identifier as an identity linked to asignal source transmitting the radio signal, wherein a dynamicconfiguration of the receiving apparatus for a received signal strengthand/or a reception frequency for receiving the radio signal is performedusing a deterministic variation scheme that corresponds to that of thetransmitter end for the radio signal and is synchronized thereto;comparing the radio identifier of the received radio signal either: (a)with a radio identifier from a predetermined sequence of radioidentifiers, wherein the radio identifier is selected from the radioidentifiers defined by the sequence, using a predetermined deterministicupdate scheme assigned to this sequence; or (b) with one or more radioidentifiers that are each selected from another sequence, which areselected from a plurality of predefined, different and respectivelypseudorandom sequences of radio identifiers using a predeterminedselection rule, using a predetermined deterministic update schemeassigned to the respective selected sequence; and triggering apredetermined functionality on the receiving apparatus only if thecomparison reveals that the received radio identifier are concordantwith one of the radio identifiers compared therewith according to apredetermined comparison criterion.
 29. A mobile radio apparatus,having: a communication unit for radio communication with a remotestation; and a processing unit for generating at least one pseudorandomsequence of radio identifiers and for selecting radio identifiers fromthe sequences; wherein the mobile radio apparatus is configured to carryout the method according to claim
 1. 30. A system for transmitting andidentifying radio identifiers, having: the mobile radio apparatus ofclaim 29, which is configured to carry out the method of claim 16; andat least one receiving apparatus configured to carry out the method ofclaim 28 in interaction with the mobile radio apparatus acting as atransmitter.
 31. The system according to claim 30, wherein: thereceiving apparatus is also configured to transmit radio signals to themobile radio apparatus, using the method of claim 16; and the varying ofthe transmission power and/or transmission frequency of radio signalstransmitted by the first radio apparatus is effected in the same way asand in synchronization with the varying of the transmission power and/ortransmission frequency of radio signals transmitted by the second mobileradio apparatus.
 2. A motor vehicle, comprising: the mobile radioapparatus of claim 29 or the system of claim 30.